Fix fork-PR false failures in security-scan

- continue-on-error on the SARIF upload step: GITHUB_TOKEN is forced
  read-only on pull_request runs triggered from forks regardless of the
  security-events: write permission declared in this workflow, so the
  upload always failed on external contributions (this repo has them -
  see PR #5). That failure was indistinguishable from a real Psalm
  finding in the job's status. The final step already gates correctly
  on steps.psalm.outcome alone, so this doesn't lose any signal.
- Drop 'develop' from the push trigger - this repo no longer has a
  permanent develop branch.

Found by /code-review on PR #6.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: dconlan

.github/workflows/security-scan.yml

@@ -3,7 +3,7 @@ name: security-scan
 on:
   pull_request:
   push:
-    branches: [main, develop]
+    branches: [main]
 
 permissions:
   contents: read
@@ -29,10 +29,17 @@ jobs:
         run: vendor/bin/psalm --taint-analysis --no-progress --report=psalm-results.sarif
         continue-on-error: true
 
+      # continue-on-error too: GITHUB_TOKEN is forced read-only on pull_request
+      # runs triggered from forks, regardless of the security-events: write
+      # permission declared above, so this step fails on every fork PR
+      # (this repo has external contributors - see PR #5) for a reason
+      # unrelated to Psalm's actual findings. Without this, that failure
+      # would be indistinguishable from a real security finding.
       - name: Upload results to code scanning
         uses: github/codeql-action/upload-sarif@v3
         with:
           sarif_file: psalm-results.sarif
+        continue-on-error: true
 
       - name: Fail the job if Psalm found issues
         if: steps.psalm.outcome == 'failure'